hxxps://release-assets[.]githubusercontent[.]com/github-production-release-asset/1347087265/9574f752-e22b-47b8-955a-13498c43c8f4?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-08-26T23%3A51%3A10Z&rscd=attachment%3B+filename%3DOrionBlue_Beta_2[.]1[.]1[.]zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-08-26T22%3A50%3A19Z&ske=2026-08-26T23%3A51%3A10Z&sks=b&skv=2018-11-09&sig=CrTwo3%2B9jLKxxSo5oPpA6mZ0%2F%2FCXfPCUfIjtUGTVngo%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9[.]eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4Nzc4NzU2OSwibmJmIjoxNzg3Nzg1NzY5LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ[.]oPxZU1JaLY6KZJz4wra2lH08BOk3IKws2rTPw07ffEU&response-content-disposition=attachment%3B%20filename%3DOrionBlue_Beta_2[.]1[.]1[.]zip&response-content-type=application%2Foctet-stream

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
69	ipapi.co
128	ipapi.co

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 7 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

persistence privilege_escalation

Process Discovery

T1057

pid	Process
4716	tasklist.exe
6876	tasklist.exe
6020	tasklist.exe
6944	tasklist.exe
4672	tasklist.exe
6124	tasklist.exe
3240	tasklist.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF88CC61F1224F7744.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e599f29.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCCFF64029D2C095D.TMP	msiexec.exe
File created	C:\Windows\Installer\e599f2d.msi	msiexec.exe
File created	C:\Windows\Installer\e599f2e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF7746A782A1312FC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5386.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7E3C2EBD9C281C94.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e599f2e.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}	msiexec.exe
File opened for modification	C:\Windows\Installer\e599f45.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFA077D4658DDBEA3.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9D09C9EF-A57C-422A-B79A-CC922079653A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA55E.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0158093D-F809-455B-9429-6D16A4B5D118}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF125DF74F882555FE.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D6B.tmp	msiexec.exe
File created	C:\Windows\Installer\e599f3f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5472.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA6E6F78269344F6E.TMP	msiexec.exe
File created	C:\Windows\Installer\e599f32.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF19928B9C4144E7F8.TMP	msiexec.exe
File created	C:\Windows\Installer\e599f3b.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF5F6A426103F1B3C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID9B1.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF119FEA577CDA7BA2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF91.tmp	msiexec.exe
File created	C:\Windows\Installer\e599f24.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB73F28C39B55C679.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7702A1BCE9AA7475.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{665A0435-D5D5-4A49-9DE0-FBC23C5425ED}	msiexec.exe
File opened for modification	C:\Windows\Installer\e599f40.msi	msiexec.exe
File created	C:\Windows\Installer\e599f44.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e599f28.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e599f3b.msi	msiexec.exe
File created	C:\Windows\Installer\e599f40.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF29234B41714FBD15.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCD0457C8017537FB.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9E1DFF77024324C3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA753.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0BE79A654A53B00F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD9CF863381517BEA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF2682D052FC508C7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5763C3430E5CCA4F.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{75485683-EF03-41E6-BF21-D1491694548C}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CD0A1663-DC2D-41BD-89AF-E1089E841822}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0CCA78C8DAEB0555.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2C9813A6E604948D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF22E108556200879E.TMP	msiexec.exe
File created	C:\Windows\Installer\e599f49.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e599f29.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF6FB5E0D3A2C9EF3.TMP	msiexec.exe
File created	C:\Windows\Installer\e599f36.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F0F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e599f24.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF55F0D11B3C8A276D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC50E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF02C00B6386C31252.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFED8438ABA926F835.TMP	msiexec.exe
File created	C:\Windows\Installer\e599f45.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF37D6582EB6B43BEC.TMP	msiexec.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
788	powershell.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6628	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2584	cmd.exe
7052	cmd.exe
6412	cmd.exe
1608	cmd.exe
6332	cmd.exe
5776	cmd.exe
5124	cmd.exe
3360	cmd.exe
6840	cmd.exe
7140	cmd.exe
6088	cmd.exe
6852	cmd.exe
1892	cmd.exe
4320	cmd.exe
6340	cmd.exe
7004	cmd.exe
6532	cmd.exe
4560	cmd.exe
2540	cmd.exe
1172	cmd.exe
4816	cmd.exe
4636	cmd.exe
6036	cmd.exe
5180	cmd.exe
6180	cmd.exe
2804	cmd.exe
6780	cmd.exe
4888	cmd.exe
4136	cmd.exe
2384	cmd.exe
6480	cmd.exe
1308	cmd.exe
648	cmd.exe
4704	cmd.exe
6888	cmd.exe
6316	cmd.exe
2240	cmd.exe
1812	cmd.exe
3508	cmd.exe
5672	cmd.exe
3352	cmd.exe
6692	cmd.exe
8	cmd.exe
6812	cmd.exe
1748	cmd.exe
3044	cmd.exe
6900	cmd.exe
4972	cmd.exe
6280	cmd.exe
384	cmd.exe
5448	cmd.exe
7060	cmd.exe
6500	cmd.exe
5284	cmd.exe
6560	cmd.exe
6632	cmd.exe
7008	cmd.exe
5384	cmd.exe
6628	cmd.exe
6488	cmd.exe
1596	cmd.exe
6176	cmd.exe
7084	cmd.exe
1252	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.10-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.10-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrionBlue Setup 2.1.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python312_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python312_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.10-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

pid	Process
6240	netsh.exe
4744	cmd.exe
5232	netsh.exe
7052	cmd.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
4064	msedge.exe
5696	chrome.exe
4668	chrome.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	OrionBlue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	OrionBlue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OrionBlue.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

defense_evasion spyware trojan

Command and Scripting Interpreter

T1059

pid	Process
1676	ipconfig.exe

Kills process with taskkill 57 IoCs

defense_evasion

pid	Process
6824	taskkill.exe
6608	taskkill.exe
1656	taskkill.exe
3316	taskkill.exe
7116	taskkill.exe
1424	taskkill.exe
4924	taskkill.exe
6552	taskkill.exe
5796	taskkill.exe
1812	taskkill.exe
2136	taskkill.exe
5588	taskkill.exe
6864	taskkill.exe
2344	taskkill.exe
6204	taskkill.exe
4444	taskkill.exe
4552	taskkill.exe
4068	taskkill.exe
6916	taskkill.exe
7144	taskkill.exe
1064	taskkill.exe
3248	taskkill.exe
4704	taskkill.exe
4672	taskkill.exe
5312	taskkill.exe
3792	taskkill.exe
5892	taskkill.exe
3236	taskkill.exe
2288	taskkill.exe
1636	taskkill.exe
7096	taskkill.exe
7092	taskkill.exe
3484	taskkill.exe
3772	taskkill.exe
6256	taskkill.exe
4308	taskkill.exe
1072	taskkill.exe
6960	taskkill.exe
5436	taskkill.exe
6832	taskkill.exe
6440	taskkill.exe
6000	taskkill.exe
5320	taskkill.exe
3348	taskkill.exe
6432	taskkill.exe
5804	taskkill.exe
6420	taskkill.exe
5560	taskkill.exe
5040	taskkill.exe
7144	taskkill.exe
5156	taskkill.exe
1812	taskkill.exe
2240	taskkill.exe
4668	taskkill.exe
6196	taskkill.exe
1576	taskkill.exe
6640	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322601719044353"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\.pyc	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{4A285122-D2B5-4C35-A279-CE9BD2CA15A0}\Version = "3.12.10150.0"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\ = "{0158093D-F809-455B-9429-6D16A4B5D118}"	python-3.12.10-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}\DisplayName = "Python 3.12.10 Standard Library (64-bit)"	python-3.12.10-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{75485683-EF03-41E6-BF21-D1491694548C}\ = "{75485683-EF03-41E6-BF21-D1491694548C}"	python-3.12.10-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_CLASSES\INSTALLER\DEPENDENCIES\{0158093D-F809-455B-9429-6D16A4B5D118}\DEPENDENTS\{B6CE88EB-2CE3-4D91-8EFC-425AE1F48CAF}	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{665A0435-D5D5-4A49-9DE0-FBC23C5425ED}	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{665A0435-D5D5-4A49-9DE0-FBC23C5425ED}\ = "{665A0435-D5D5-4A49-9DE0-FBC23C5425ED}"	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.CompiledFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{4A285122-D2B5-4C35-A279-CE9BD2CA15A0}	python312_installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_CLASSES\INSTALLER\DEPENDENCIES\{9D09C9EF-A57C-422A-B79A-CC922079653A}\DEPENDENTS\{B6CE88EB-2CE3-4D91-8EFC-425AE1F48CAF}	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.File\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.ArchiveFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConArchiveFile\shellex	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{4A285122-D2B5-4C35-A279-CE9BD2CA15A0}\ = "{4A285122-D2B5-4C35-A279-CE9BD2CA15A0}"	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{D89D3188-E5B9-41BD-A24F-DFDBA4838023}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\ = "{0158093D-F809-455B-9429-6D16A4B5D118}"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\DisplayName = "Python 3.12.10 Core Interpreter (64-bit)"	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.CompiledFile\shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.CompiledFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",2"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConArchiveFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.Extension	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\.pyz	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{4A285122-D2B5-4C35-A279-CE9BD2CA15A0}\Dependents	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}	python-3.12.10-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_CLASSES\INSTALLER\DEPENDENCIES\CPYTHON-3.12\DEPENDENTS\{B6CE88EB-2CE3-4D91-8EFC-425AE1F48CAF}	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConFile	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.ArchiveFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConArchiveFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.CompiledFile\DefaultIcon	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\Version = "3.12.10150.0"	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{75485683-EF03-41E6-BF21-D1491694548C}	python-3.12.10-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.CompiledFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}"	python312_installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.File\Shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{665A0435-D5D5-4A49-9DE0-FBC23C5425ED}\Version = "3.12.10150.0"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.CompiledFile\ = "Compiled Python File"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\Version = "3.12.10150.0"	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{75485683-EF03-41E6-BF21-D1491694548C}\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python312_installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\.pyo\ = "Python.CompiledFile"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.ArchiveFile\shellex	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{0158093D-F809-455B-9429-6D16A4B5D118}\Dependents	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.File\Shell\editwithidle	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConFile\Shell\editwithidle	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConFile\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\.pyd	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\.pyzw\ = "Python.NoConArchiveFile"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{CD0A1663-DC2D-41BD-89AF-E1089E841822}	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{CD0A1663-DC2D-41BD-89AF-E1089E841822}\Version = "3.12.10150.0"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\Version = "3.12.10150.0"	python312_installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\MUIVerb = "Edit with IDLE 3.12 (64-bit)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConFile\Shell\editwithidle\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.File\Shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.NoConFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Python.ArchiveFile\DefaultIcon	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	python.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	python.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	python.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	python.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	python.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\OrionBlue_Beta_2.1.1.zip:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Local\orionblue-updater\installer.exe\:Zone.Identifier:$DATA	OrionBlue Setup 2.1.1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5368	OrionBlue Setup 2.1.1.exe
5368	OrionBlue Setup 2.1.1.exe
4716	tasklist.exe
4716	tasklist.exe
4540	powershell.exe
4540	powershell.exe
4540	powershell.exe
5300	powershell.exe
5300	powershell.exe
2916	powershell.exe
2916	powershell.exe
3924	powershell.exe
3924	powershell.exe
1424	powershell.exe
2400	powershell.exe
1424	powershell.exe
2400	powershell.exe
2916	powershell.exe
3924	powershell.exe
2400	powershell.exe
1424	powershell.exe
5300	powershell.exe
3192	powershell.exe
3192	powershell.exe
3192	powershell.exe
6752	powershell.exe
6752	powershell.exe
6752	powershell.exe
4816	powershell.exe
4816	powershell.exe
4816	powershell.exe
2968	powershell.exe
2968	powershell.exe
2968	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
3312	powershell.exe
3312	powershell.exe
3312	powershell.exe
5352	powershell.exe
5352	powershell.exe
788	powershell.exe
788	powershell.exe
4616	powershell.exe
4616	powershell.exe
6120	powershell.exe
6120	powershell.exe
6616	powershell.exe
6616	powershell.exe
1536	powershell.exe
1536	powershell.exe
1800	powershell.exe
1800	powershell.exe
3564	powershell.exe
3564	powershell.exe
788	powershell.exe
5352	powershell.exe
6616	powershell.exe
1800	powershell.exe
3564	powershell.exe
4616	powershell.exe
6120	powershell.exe
1536	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	tasklist.exe
Token: SeSecurityPrivilege	5368	OrionBlue Setup 2.1.1.exe
Token: SeIncreaseQuotaPrivilege	2660	WMIC.exe
Token: SeSecurityPrivilege	2660	WMIC.exe
Token: SeTakeOwnershipPrivilege	2660	WMIC.exe
Token: SeLoadDriverPrivilege	2660	WMIC.exe
Token: SeSystemProfilePrivilege	2660	WMIC.exe
Token: SeSystemtimePrivilege	2660	WMIC.exe
Token: SeProfSingleProcessPrivilege	2660	WMIC.exe
Token: SeIncBasePriorityPrivilege	2660	WMIC.exe
Token: SeCreatePagefilePrivilege	2660	WMIC.exe
Token: SeBackupPrivilege	2660	WMIC.exe
Token: SeRestorePrivilege	2660	WMIC.exe
Token: SeShutdownPrivilege	2660	WMIC.exe
Token: SeDebugPrivilege	2660	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2660	WMIC.exe
Token: SeRemoteShutdownPrivilege	2660	WMIC.exe
Token: SeUndockPrivilege	2660	WMIC.exe
Token: SeManageVolumePrivilege	2660	WMIC.exe
Token: 33	2660	WMIC.exe
Token: 34	2660	WMIC.exe
Token: 35	2660	WMIC.exe
Token: 36	2660	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2660	WMIC.exe
Token: SeSecurityPrivilege	2660	WMIC.exe
Token: SeTakeOwnershipPrivilege	2660	WMIC.exe
Token: SeLoadDriverPrivilege	2660	WMIC.exe
Token: SeSystemProfilePrivilege	2660	WMIC.exe
Token: SeSystemtimePrivilege	2660	WMIC.exe
Token: SeProfSingleProcessPrivilege	2660	WMIC.exe
Token: SeIncBasePriorityPrivilege	2660	WMIC.exe
Token: SeCreatePagefilePrivilege	2660	WMIC.exe
Token: SeBackupPrivilege	2660	WMIC.exe
Token: SeRestorePrivilege	2660	WMIC.exe
Token: SeShutdownPrivilege	2660	WMIC.exe
Token: SeDebugPrivilege	2660	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2660	WMIC.exe
Token: SeRemoteShutdownPrivilege	2660	WMIC.exe
Token: SeUndockPrivilege	2660	WMIC.exe
Token: SeManageVolumePrivilege	2660	WMIC.exe
Token: 33	2660	WMIC.exe
Token: 34	2660	WMIC.exe
Token: 35	2660	WMIC.exe
Token: 36	2660	WMIC.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	5300	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	6864	taskkill.exe
Token: SeShutdownPrivilege	1944	OrionBlue.exe
Token: SeCreatePagefilePrivilege	1944	OrionBlue.exe
Token: SeShutdownPrivilege	1944	OrionBlue.exe
Token: SeCreatePagefilePrivilege	1944	OrionBlue.exe
Token: SeIncreaseQuotaPrivilege	3924	powershell.exe
Token: SeSecurityPrivilege	3924	powershell.exe
Token: SeTakeOwnershipPrivilege	3924	powershell.exe
Token: SeLoadDriverPrivilege	3924	powershell.exe
Token: SeSystemProfilePrivilege	3924	powershell.exe
Token: SeSystemtimePrivilege	3924	powershell.exe
Token: SeProfSingleProcessPrivilege	3924	powershell.exe
Token: SeIncBasePriorityPrivilege	3924	powershell.exe
Token: SeCreatePagefilePrivilege	3924	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
6684	7zG.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3416	MiniSearchHost.exe
3772	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 1892	5592	msedge.exe	80
PID 5592 wrote to memory of 4064	5592	msedge.exe	81
PID 5592 wrote to memory of 2608	5592	msedge.exe	82
PID 5592 wrote to memory of 2608	5592	msedge.exe	82
PID 5592 wrote to memory of 2608	5592	msedge.exe	82
PID 5592 wrote to memory of 2624	5592	msedge.exe	83
PID 5592 wrote to memory of 2624	5592	msedge.exe	83
PID 5592 wrote to memory of 3044	5592	msedge.exe	85
PID 5592 wrote to memory of 6048	5592	msedge.exe	86
PID 5592 wrote to memory of 3044	5592	msedge.exe	85
PID 5592 wrote to memory of 3044	5592	msedge.exe	85
PID 5592 wrote to memory of 6048	5592	msedge.exe	86
PID 5592 wrote to memory of 6048	5592	msedge.exe	86
PID 5592 wrote to memory of 5556	5592	msedge.exe	88
PID 5592 wrote to memory of 2136	5592	msedge.exe	89
PID 5592 wrote to memory of 5556	5592	msedge.exe	88
PID 5592 wrote to memory of 2136	5592	msedge.exe	89
PID 5592 wrote to memory of 3640	5592	msedge.exe	90
PID 5592 wrote to memory of 5616	5592	msedge.exe	91
PID 5592 wrote to memory of 3640	5592	msedge.exe	90
PID 5592 wrote to memory of 5616	5592	msedge.exe	91
PID 5592 wrote to memory of 5616	5592	msedge.exe	91
PID 5592 wrote to memory of 3932	5592	msedge.exe	92
PID 5592 wrote to memory of 2984	5592	msedge.exe	93
PID 5592 wrote to memory of 4428	5592	msedge.exe	95
PID 2984 wrote to memory of 972	2984	msedge.exe	96
PID 5592 wrote to memory of 2244	5592	msedge.exe	102
PID 5592 wrote to memory of 6116	5592	msedge.exe	103
PID 5592 wrote to memory of 1168	5592	msedge.exe	104
PID 5368 wrote to memory of 2584	5368	OrionBlue Setup 2.1.1.exe	107
PID 2584 wrote to memory of 4716	2584	cmd.exe	109
PID 2584 wrote to memory of 396	2584	cmd.exe	110
PID 5592 wrote to memory of 4800	5592	msedge.exe	111
PID 5592 wrote to memory of 4800	5592	msedge.exe	111
PID 5592 wrote to memory of 4800	5592	msedge.exe	111
PID 5592 wrote to memory of 4684	5592	msedge.exe	112
PID 5592 wrote to memory of 4684	5592	msedge.exe	112
PID 5592 wrote to memory of 4684	5592	msedge.exe	112
PID 5592 wrote to memory of 32	5592	msedge.exe	114
PID 5592 wrote to memory of 32	5592	msedge.exe	114
PID 5592 wrote to memory of 32	5592	msedge.exe	114
PID 5592 wrote to memory of 4572	5592	msedge.exe	115
PID 5592 wrote to memory of 4572	5592	msedge.exe	115
PID 5592 wrote to memory of 4572	5592	msedge.exe	115
PID 1944 wrote to memory of 4136	1944	OrionBlue.exe	118
PID 4136 wrote to memory of 4256	4136	cmd.exe	120
PID 5592 wrote to memory of 2440	5592	msedge.exe	121
PID 5592 wrote to memory of 2440	5592	msedge.exe	121
PID 1944 wrote to memory of 4744	1944	OrionBlue.exe	122
PID 4744 wrote to memory of 5232	4744	cmd.exe	124
PID 1944 wrote to memory of 4276	1944	OrionBlue.exe	126
PID 4276 wrote to memory of 2660	4276	cmd.exe	128
PID 1944 wrote to memory of 4636	1944	OrionBlue.exe	129
PID 4636 wrote to memory of 4540	4636	cmd.exe	131
PID 1944 wrote to memory of 436	1944	OrionBlue.exe	132
PID 1944 wrote to memory of 6036	1944	OrionBlue.exe	272
PID 1944 wrote to memory of 4560	1944	OrionBlue.exe	226
PID 1944 wrote to memory of 4564	1944	OrionBlue.exe	135
PID 1944 wrote to memory of 5776	1944	OrionBlue.exe	136
PID 1944 wrote to memory of 6016	1944	OrionBlue.exe	137
PID 1944 wrote to memory of 1864	1944	OrionBlue.exe	138
PID 1944 wrote to memory of 2540	1944	OrionBlue.exe	140
PID 1944 wrote to memory of 6116	1944	OrionBlue.exe	141
PID 1944 wrote to memory of 3320	1944	OrionBlue.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://release-assets.githubusercontent.com/github-production-release-asset/1347087265/9574f752-e22b-47b8-955a-13498c43c8f4?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-08-26T23%3A51%3A10Z&rscd=attachment%3B+filename%3DOrionBlue_Beta_2.1.1.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-08-26T22%3A50%3A19Z&ske=2026-08-26T23%3A51%3A10Z&sks=b&skv=2018-11-09&sig=CrTwo3%2B9jLKxxSo5oPpA6mZ0%2F%2FCXfPCUfIjtUGTVngo%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4Nzc4NzU2OSwibmJmIjoxNzg3Nzg1NzY5LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.oPxZU1JaLY6KZJz4wra2lH08BOk3IKws2rTPw07ffEU&response-content-disposition=attachment%3B%20filename%3DOrionBlue_Beta_2.1.1.zip&response-content-type=application%2Foctet-stream
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7fffeabfc188,0x7fffeabfc194,0x7fffeabfc1a0
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,6380931677535997111,15111301364184488511,524288 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,9865588648884011235,8988007950434649371,262144 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,12538654653622460542,18133674254475169817,524288 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:13
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,3351792580172280310,6798105799891168332,2097152 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,1950524370561048520,2485986531689581730,2097152 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,10577754178427086062,16560978995782308749,524288 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,1632552225986817417,17563725549702548753,524288 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,17077125095763719280,12025804361138528665,524288 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5604,i,11333190893447877379,14714830228761767897,2097152 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,7454921262848119039,2028432577445226700,524288 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,7378167381116534473,13216961583342077897,524288 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,3388171197834267836,9445134407786314556,524288 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,3388171197834267836,9445134407786314556,524288 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,4538139362761817969,14552620718705669766,524288 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,1753285882127227372,3505604503664629098,524288 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:14
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,9740353691431037044,1094290995529765176,524288 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5868,i,8678386100324469464,14840907784410626936,2097152 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3552,i,10414519757030886814,14988361636948160080,2097152 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3688,i,10462148245973246079,16798260428224467929,2097152 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6236,i,8330536704873909453,13637620890581588858,2097152 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,16750853587720244349,16999442356707563334,524288 --field-trial-handle=2188,i,13245385317283806683,15957142866179390334,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:14
  2⤵
  PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5760

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3416

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4680

C:\Users\Admin\Downloads\OrionBlue_Beta_2.1.1\OrionBlue_Beta_2.1.1\OrionBlue Setup 2.1.1.exe
"C:\Users\Admin\Downloads\OrionBlue_Beta_2.1.1\OrionBlue_Beta_2.1.1\OrionBlue Setup 2.1.1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq OrionBlue.exe" /FO csv | "C:\Windows\system32\find.exe" "OrionBlue.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq OrionBlue.exe" /FO csv
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4716
- - C:\Windows\SysWOW64\find.exe
    "C:\Windows\system32\find.exe" "OrionBlue.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:396

C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe
"C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:4256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "openssl version"
  2⤵
  PID:436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "npm -v"
  2⤵
  - Executes a command shell one-liner
  PID:6036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"
  2⤵
  - Executes a command shell one-liner
  PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "yarn --version"
  2⤵
  PID:4564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"
  2⤵
  - Executes a command shell one-liner
  PID:5776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "brew --version"
  2⤵
  PID:6016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"
  2⤵
  PID:1864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"
  2⤵
  - Executes a command shell one-liner
  PID:2540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "git --version"
  2⤵
  PID:6116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"
  2⤵
  PID:3320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"
  2⤵
  PID:5792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mysql -V"
  2⤵
  - Executes a command shell one-liner
  PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "php -v"
  2⤵
  PID:5800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "redis-server --version"
  2⤵
  - Executes a command shell one-liner
  PID:384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "docker --version"
  2⤵
  PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"
  2⤵
  - Executes a command shell one-liner
  PID:3044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mongod --version"
  2⤵
  PID:1312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "perl -v"
  2⤵
  PID:4092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:5180
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python -V
    3⤵
    PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"
  2⤵
  PID:6084
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python3 -V
    3⤵
    PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"
  2⤵
  PID:732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"
  2⤵
  PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
  2⤵
  PID:1628
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -version
    3⤵
    PID:6716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"
  2⤵
  - Executes a command shell one-liner
  PID:5384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:3508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bash --version"
  2⤵
  - Executes a command shell one-liner
  PID:6088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "zsh --version"
  2⤵
  PID:5588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "fish --version"
  2⤵
  - Executes a command shell one-liner
  PID:5448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bun -v"
  2⤵
  PID:3600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "deno -v"
  2⤵
  PID:1148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "node -v"
  2⤵
  - Executes a command shell one-liner
  PID:1812
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3924
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1424
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:2316
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6864
- C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe
  "C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\orionblue" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2544 --field-trial-handle=2548,i,5172682300292353109,12352508230560810534,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2112
- C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe
  "C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\orionblue" --mojo-platform-channel-handle=2740 --field-trial-handle=2548,i,5172682300292353109,12352508230560810534,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc --version"
  2⤵
  - Executes a command shell one-liner
  PID:6852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:7052
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5672
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:6256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  PID:2140
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:2344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  - Executes a command shell one-liner
  PID:1172
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:5796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:4560
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
  2⤵
  PID:5708
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe
    3⤵
    - Kills process with taskkill
    PID:6204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
  2⤵
  PID:4016
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe
    3⤵
    - Kills process with taskkill
    PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
  2⤵
  - Executes a command shell one-liner
  PID:6180
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM centbrowser.exe
    3⤵
    - Kills process with taskkill
    PID:1072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
  2⤵
  PID:7064
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 7star.exe
    3⤵
    - Kills process with taskkill
    PID:7096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
  2⤵
  PID:6328
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sputnik.exe
    3⤵
    - Kills process with taskkill
    PID:7092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
  2⤵
  PID:6988
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:6608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
  2⤵
  PID:6476
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM epicprivacybrowser.exe
    3⤵
    - Kills process with taskkill
    PID:1812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
  2⤵
  PID:396
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe
    3⤵
    - Kills process with taskkill
    PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
  2⤵
  - Executes a command shell one-liner
  PID:6888
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:4068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
  2⤵
  PID:3004
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM iridium.exe
    3⤵
    - Kills process with taskkill
    PID:1064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe"
  2⤵
  PID:6760
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM tor.exe
    3⤵
    - Kills process with taskkill
    PID:1656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM waterfox.exe"
  2⤵
  - Executes a command shell one-liner
  PID:6316
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM waterfox.exe
    3⤵
    - Kills process with taskkill
    PID:6440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM arc.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3360
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6716
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM arc.exe
    3⤵
    - Kills process with taskkill
    PID:7116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
  2⤵
  PID:1500
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    PID:788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
  2⤵
  - Executes a command shell one-liner
  PID:1892
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6036
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles state
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled""
  2⤵
  PID:5044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn""
  2⤵
  PID:2472
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA"
  2⤵
  PID:2216
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA
    3⤵
    PID:6908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1""
  2⤵
  - Executes a command shell one-liner
  PID:7060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:6500
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5052
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')""
  2⤵
  PID:6544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA="
  2⤵
  - Executes a command shell one-liner
  PID:3352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled""
  2⤵
  PID:5036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3312
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4616
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5352
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:788
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6120
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1800
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6616
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  PID:1704
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
    3⤵
    - Checks processor information in registry
    PID:6424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version,vendor,installDate /format:list"
  2⤵
  PID:5884
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1148
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product get name,version,vendor,installDate /format:list
    3⤵
    PID:6936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "openssl version"
  2⤵
  PID:7024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "npm -v"
  2⤵
  PID:6976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"
  2⤵
  PID:2548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "yarn --version"
  2⤵
  - Executes a command shell one-liner
  PID:6812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"
  2⤵
  - Executes a command shell one-liner
  PID:6480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "brew --version"
  2⤵
  PID:5544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"
  2⤵
  PID:4380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"
  2⤵
  PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "git --version"
  2⤵
  PID:2144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"
  2⤵
  PID:7148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:6412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mysql -V"
  2⤵
  - Executes a command shell one-liner
  PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "php -v"
  2⤵
  PID:4612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "redis-server --version"
  2⤵
  PID:6724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "docker --version"
  2⤵
  PID:6728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"
  2⤵
  - Executes a command shell one-liner
  PID:8
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mongod --version"
  2⤵
  PID:5340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "perl -v"
  2⤵
  PID:4852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:6632
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python -V
    3⤵
    PID:1020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"
  2⤵
  PID:6064
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3508
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python3 -V
    3⤵
    PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:6628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:6692
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7116
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -version
    3⤵
    PID:2424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"
  2⤵
  PID:5112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
  2⤵
  PID:5700
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bash --version"
  2⤵
  - Executes a command shell one-liner
  PID:6560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "zsh --version"
  2⤵
  PID:5540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "fish --version"
  2⤵
  - Executes a command shell one-liner
  PID:5284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bun -v"
  2⤵
  PID:2468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "deno -v"
  2⤵
  - Executes a command shell one-liner
  PID:2384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "node -v"
  2⤵
  PID:5712
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1060
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5384
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4808
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1064
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  PID:3908
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    PID:6636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  - Executes a command shell one-liner
  PID:1308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6340
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  PID:3812
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    PID:2380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  PID:7164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5688
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:652
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6028
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1812
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1596
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4576
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc --version"
  2⤵
  PID:6744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version,vendor,installDate /format:list"
  2⤵
  PID:5392
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product get name,version,vendor,installDate /format:list
    3⤵
    PID:7088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
  2⤵
  - Executes a command shell one-liner
  PID:7008
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "route print"
  2⤵
  PID:1640
- - C:\Windows\system32\ROUTE.EXE
    route print
    3⤵
    PID:3180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic service get name,displayName,state,startMode,pathName /format:list"
  2⤵
  - Executes a command shell one-liner
  PID:6840
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic service get name,displayName,state,startMode,pathName /format:list
    3⤵
    PID:6200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  PID:2196
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6340
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
    3⤵
    - Checks processor information in registry
    PID:5240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  PID:6080
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5460
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6540
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6656
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4496
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6752
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2288
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1848
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  PID:7104
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey""
  2⤵
  PID:4884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2248
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6020
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  - Executes a command shell one-liner
  PID:6780
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3600
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1636
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  PID:5260
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "py -3 --version"
  2⤵
  - Executes a command shell one-liner
  PID:4320
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "py --version"
  2⤵
  - Executes a command shell one-liner
  PID:6488
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python --version"
  2⤵
  - Executes a command shell one-liner
  PID:1596
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4576
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python --version
    3⤵
    PID:6724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python3 --version"
  2⤵
  PID:4612
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5284
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    python3 --version
    3⤵
    PID:404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0"
  2⤵
  - Executes a command shell one-liner
  PID:6900
- - C:\Users\Admin\AppData\Local\Temp\python312_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2724
  - - C:\Windows\Temp\{5CBAFE30-01A8-4F0E-964B-751B8D71D86B}\.cr\python312_installer.exe
      "C:\Windows\Temp\{5CBAFE30-01A8-4F0E-964B-751B8D71D86B}\.cr\python312_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python312_installer.exe" -burn.filehandle.attached=740 -burn.filehandle.self=744 /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" --version"
  2⤵
  - Executes a command shell one-liner
  PID:648
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip"
  2⤵
  - Executes a command shell one-liner
  PID:6176
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6976
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --upgrade pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    PID:6628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows"
  2⤵
  - Executes a command shell one-liner
  PID:6340
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pythonforwindows
    3⤵
    - Executes dropped EXE
    PID:6288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome"
  2⤵
  - Executes a command shell one-liner
  PID:7084
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -m pip install --disable-pip-version-check --quiet --no-cache-dir --user pycryptodome
    3⤵
    - Executes dropped EXE
    PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\vexx_verify_install_deps.py""
  2⤵
  PID:3768
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\vexx_verify_install_deps.py"
    3⤵
    - Executes dropped EXE
    PID:1676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py""
  2⤵
  PID:668
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\check_deps.py"
    3⤵
    - Executes dropped EXE
    PID:3144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Executes a command shell one-liner
  PID:1748
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:6432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  PID:5772
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:7144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  PID:8
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:5804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:5792
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:6960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:5488
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:6420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
  2⤵
  PID:6788
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe
    3⤵
    - Kills process with taskkill
    PID:3316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
  2⤵
  - Executes a command shell one-liner
  PID:1608
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe
    3⤵
    - Kills process with taskkill
    PID:3792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
  2⤵
  - Executes a command shell one-liner
  PID:7140
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM centbrowser.exe
    3⤵
    - Kills process with taskkill
    PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
  2⤵
  PID:1568
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6724
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 7star.exe
    3⤵
    - Kills process with taskkill
    PID:4704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4816
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6288
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sputnik.exe
    3⤵
    - Kills process with taskkill
    PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
  2⤵
  PID:2052
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:2288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
  2⤵
  - Executes a command shell one-liner
  PID:1252
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM epicprivacybrowser.exe
    3⤵
    - Kills process with taskkill
    PID:6000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4972
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe
    3⤵
    - Kills process with taskkill
    PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
  2⤵
  - Executes a command shell one-liner
  PID:6332
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:6196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
  2⤵
  PID:3748
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM iridium.exe
    3⤵
    - Kills process with taskkill
    PID:1812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe"
  2⤵
  PID:6712
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM tor.exe
    3⤵
    - Kills process with taskkill
    PID:5436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM waterfox.exe"
  2⤵
  PID:7024
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM waterfox.exe
    3⤵
    - Kills process with taskkill
    PID:5156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM arc.exe"
  2⤵
  PID:6648
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM arc.exe
    3⤵
    - Kills process with taskkill
    PID:5320
- C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe
  "C:\Users\Admin\AppData\Local\Programs\orionblue\OrionBlue.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\orionblue" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1680 --field-trial-handle=2548,i,5172682300292353109,12352508230560810534,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\vexx_py_runner.py""
  2⤵
  PID:2652
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\vexx_py_runner.py"
    3⤵
    - Executes dropped EXE
    PID:6580
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:6832
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:1576
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:1424
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:3348
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:5560
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:4444
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:6916
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:5892
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:1636
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      Kills process with taskkill
      PID:6640
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM browser.exe
      4⤵
      Kills process with taskkill
      PID:2136
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM QQBrowser.exe
      4⤵
      Kills process with taskkill
      PID:5312
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      Kills process with taskkill
      PID:4924
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM 360chrome.exe
      4⤵
      Kills process with taskkill
      PID:3484
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:5588
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:4308
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:3772
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:7144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
  2⤵
  - Executes a command shell one-liner
  PID:7004
- - C:\Windows\system32\taskkill.exe
    taskkill /IM javaw.exe /F
    3⤵
    - Kills process with taskkill
    PID:3236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"
  2⤵
  PID:4848
- - C:\Windows\system32\taskkill.exe
    taskkill /IM EpicGamesLauncher.exe /F
    3⤵
    - Kills process with taskkill
    PID:6552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
  2⤵
  - Executes a command shell one-liner
  PID:4888
- - C:\Windows\system32\taskkill.exe
    taskkill /IM Steam.exe /F
    3⤵
    - Kills process with taskkill
    PID:6824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "sc config node DisplayName= "System Settings Provider""
  2⤵
  - Executes a command shell one-liner
  PID:6532
- - C:\Windows\system32\sc.exe
    sc config node DisplayName= "System Settings Provider"
    3⤵
    - Launches sc.exe
    PID:6628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i svchost.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4704
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:6876
- - C:\Windows\system32\findstr.exe
    findstr /i svchost.exe
    3⤵
    PID:5724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i winlogon.exe"
  2⤵
  PID:1040
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4672
- - C:\Windows\system32\findstr.exe
    findstr /i winlogon.exe
    3⤵
    PID:2832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i services.exe"
  2⤵
  PID:6004
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:6944
- - C:\Windows\system32\findstr.exe
    findstr /i services.exe
    3⤵
    PID:3212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i explorer.exe"
  2⤵
  - Executes a command shell one-liner
  PID:6280
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3240
- - C:\Windows\system32\findstr.exe
    findstr /i explorer.exe
    3⤵
    PID:3632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i dllhost.exe"
  2⤵
  PID:5252
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:6020
- - C:\Windows\system32\findstr.exe
    findstr /i dllhost.exe
    3⤵
    PID:5552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i taskhostw.exe"
  2⤵
  PID:3148
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5068
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:6124
- - C:\Windows\system32\findstr.exe
    findstr /i taskhostw.exe
    3⤵
    PID:6880

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
PID:2680
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 925456CD239853EDCECC94C289F016C3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5096
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -I -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6168
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpmyces9ol\\pip-25.0.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpmyces9ol', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6428

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap32532:2474:7zEvent254 -ad -saa -- "C:\Users\Admin\AppData\Local\Programs\orionblue\orionblue"
1⤵
- Suspicious use of FindShellTrayWindow
PID:6684

C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
"C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:820
- C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
  "C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20260827002423.log" InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6608
- - C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
    "C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20260827002423.log" InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_test=0 Include_doc=0 Include_dev=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:6932

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:7088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffeab5c728,0x7fffeab5c734,0x7fffeab5c740
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1844,i,11339548462807464123,1867388663113250015,262144 --field-trial-handle=1916,i,15840445468518142422,9058738530380440833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,6892955495058885178,9341776040398693478,524288 --field-trial-handle=1916,i,15840445468518142422,9058738530380440833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2276 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,14657049677599841569,4150554784180235934,524288 --field-trial-handle=1916,i,15840445468518142422,9058738530380440833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1452 /prefetch:13
  2⤵
  PID:6672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,7875233270199912457,9588737278283211867,2097152 --field-trial-handle=1916,i,15840445468518142422,9058738530380440833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3412,i,15158743275150076984,7403359836565940598,2097152 --field-trial-handle=1916,i,15840445468518142422,9058738530380440833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4448,i,1486759822139020339,10773577331013411417,2097152 --field-trial-handle=1916,i,15840445468518142422,9058738530380440833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:9
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,9594784617808374890,10509474644029019395,2097152 --field-trial-handle=1916,i,15840445468518142422,9058738530380440833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4976,i,15726500671848367913,4055281287435915264,2097152 --field-trial-handle=1916,i,15840445468518142422,9058738530380440833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:6668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffeab5c728,0x7fffeab5c734,0x7fffeab5c740
  2⤵
  PID:652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1904,i,11162104782751853508,14000290713385438613,524288 --field-trial-handle=2080,i,5622489895065534202,17825184516009797461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2124 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,6018029182779053797,8363430069426629730,262144 --field-trial-handle=2080,i,5622489895065534202,17825184516009797461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,11614106913841475869,823480431229415155,524288 --field-trial-handle=2080,i,5622489895065534202,17825184516009797461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2420 /prefetch:13
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,4779146667312729729,4091409215323470221,2097152 --field-trial-handle=2080,i,5622489895065534202,17825184516009797461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3412,i,1183764003765188482,14875100509796099346,2097152 --field-trial-handle=2080,i,5622489895065534202,17825184516009797461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4564,i,2242778405780972163,10015885798798135248,2097152 --field-trial-handle=2080,i,5622489895065534202,17825184516009797461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,1104114579362943364,17491368446713108450,524288 --field-trial-handle=2080,i,5622489895065534202,17825184516009797461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5264 /prefetch:14
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5348,i,8111193767416057881,17797714614363138806,2097152 --field-trial-handle=2080,i,5622489895065534202,17825184516009797461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3556,i,4438229555135914484,6565934988741492988,2097152 --field-trial-handle=2080,i,5622489895065534202,17825184516009797461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:6920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,13759259517043301478,2084866294004761562,524288 --field-trial-handle=2080,i,5622489895065534202,17825184516009797461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,7119629514358737646,14737835351928098146,524288 --field-trial-handle=2080,i,5622489895065534202,17825184516009797461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5712 /prefetch:14
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,14814220093693497795,3200013629274080101,524288 --field-trial-handle=2080,i,5622489895065534202,17825184516009797461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,16232064581238050933,6752399786750206890,524288 --field-trial-handle=2080,i,5622489895065534202,17825184516009797461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:3592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery